24581fecf45db036e65ef3b6ab3e0b39d2f991d750dae86ae1a9421f6fb80e67

Analysis

max time kernel
145s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
02/05/2024, 07:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-02_7bdf36c822019a1bf7bf03c3abb2a42f_icedid_scarhikn.exe
Size

221KB
MD5

7bdf36c822019a1bf7bf03c3abb2a42f
SHA1

fe4b8b9aa9597cbbc258aa8e2382a32b322b2a3e
SHA256

24581fecf45db036e65ef3b6ab3e0b39d2f991d750dae86ae1a9421f6fb80e67
SHA512

abe4fa93244cdd2ad7d757fcb19dfd732ca1f47cfa2ab69226f0f28ae5f9e73e2d129d472c061dea81acad08e99d0c86f667ef01dc729762fcb67260e6895ea8
SSDEEP

3072:UP95fwVjSH3MZ0YQRYrgWbdGpEe3f1C/q/CM4BoQF9nEYvQd2a:UP95Eq3MqYQugDf1CCwnDa

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3604 wrote to memory of 744	3604	2024-05-02_7bdf36c822019a1bf7bf03c3abb2a42f_icedid_scarhikn.exe	91
PID 3604 wrote to memory of 744	3604	2024-05-02_7bdf36c822019a1bf7bf03c3abb2a42f_icedid_scarhikn.exe	91
PID 3604 wrote to memory of 744	3604	2024-05-02_7bdf36c822019a1bf7bf03c3abb2a42f_icedid_scarhikn.exe	91

C:\Users\Admin\AppData\Local\Temp\2024-05-02_7bdf36c822019a1bf7bf03c3abb2a42f_icedid_scarhikn.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-02_7bdf36c822019a1bf7bf03c3abb2a42f_icedid_scarhikn.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3604
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\yyyy.bat
  2⤵
  PID:744

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4112 --field-trial-handle=2292,i,2103142837140538807,15881446839139365070,262144 --variations-seed-version /prefetch:8
1⤵
PID:2916

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\yyyy

Filesize
221KB

MD5
4b483cbffee882ba9c6f4e8741acd452

SHA1
46b2848764d13e9acad2368d1840c7d7beda7e75

SHA256
b6cae9372662fbff648856d30f15e0fdeff85bf4df3b9f524b31028b8bc0f9d0

SHA512
9f49488bbbadd277605e64a404f51197a44b01c8b9df4a4ab8c17672cd3ab83b7fc9f0bde8bd57114fd7804fe111dd455a69068ab8a74c77eb4b603006de8f8f

Download Submit
C:\Users\Admin\AppData\Local\Temp\yyyy.bat

Filesize
337B

MD5
f0628c76595ba67cb62ab4979435af48

SHA1
7b28c9fc12343ab5588246577716c66db55bb14b

SHA256
7cf3702f137b77e031ae2f4e2bcdd201c4fbc0d61da9c7aa714176fda6a373a3

SHA512
3d61de031c90feaef8f8342a8e45212bc2f67eae8c738a98680bad4b1ae52bb72f7d83ad2ee03ec24c16201e78d5fdb83b003acb88f713fae09e6ebb0b6cc609

Download Submit
memory/3604-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3604-6-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download